trantor 0.18.77 → 0.18.79

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.77",
+  "version": "0.18.79",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/cmux.mjs

@@ -55,6 +55,7 @@ function tracked(ctx) {
 
 function prepare(ctx, prune) {
   const result = tracked(ctx);
+  if (ctx.swap) return result.reuse;
   for (const id of result.stale) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);
@@ -178,6 +179,7 @@ function spawnAppleScript(ctx, specs, resolve) {
 function prepareAppleScriptWorkspace(ctx) {
   const ids = readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmuxws").map(row => row.handle);
   const reuse = ids.at(-1) || "";
+  if (ctx.swap) return reuse;
   for (const id of ids.slice(0, -1)) {
     console.log(`  → closing stale stacked crew workspace for ${ctx.project} (${id})`);
     closeWorkspace(ctx, id);

package/bin/crew/core.mjs

@@ -146,8 +146,9 @@ export function runnerCommand(ctx, agent, model = "", effort = null) {
     .join("");
   // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
   // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
+  const swapEnv = ctx.swap ? ` CREW_SWAP_STAGE=${shellQuote(ctx.swap.path)} CREW_SWAP_LABEL=${shellQuote(ctx.swap.label)} CREW_SWAP_AGENT=${shellQuote(ctx.swap.agent)} CREW_SWAP_DRIVER=${shellQuote(ctx.swap.driver || "")}` : "";
   const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv}${swapEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -121,6 +121,7 @@ function orchPaneWorkspaces(ctx) {
 
 function prepareWorkspace(ctx, prune) {
   const tracked = trackedWorkspace(ctx);
+  if (ctx.swap) return tracked.reuse;
   const orchSpaces = orchPaneWorkspaces(ctx);
   for (const id of tracked.stale) {
     // #7285: never close reuse itself, nor a workspace hosting the tracked orch pane — `up` once

package/bin/crew/models.mjs

@@ -1,7 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { call } from "./core.mjs";
-import { reapSeat } from "./state.mjs";
 import { resolveEffort } from "../../lib/model-catalog.mjs";
 
 function routeModel(ctx, provider, candidates, task, difficulty) {
@@ -21,7 +20,8 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
   const candidates = result.ok ? result.stdout.split(/\s+/).filter(Boolean).join(" ") : "";
   let model = routeModel(ctx, provider, candidates, task, difficulty);
   if (!model && candidates) {
-    model = `${provider}/${candidates.split(" ")[0]}`;
+    const first = candidates.split(" ")[0];
+    model = first.startsWith(`${provider}/`) ? first : `${provider}/${first}`;
     console.error(`[crew] router unavailable for ${agent}:${provider} — using the provider's own catalog head (${model})`);
   }
   if (!model) throw new Error(`[crew] live model selection failed for ${agent}:${provider} — no router and no catalog; refusing opencode global default`);
@@ -31,7 +31,6 @@ export function resolveModel(ctx, agent, provider, task, difficulty) {
 
 export function resolveSpec(ctx, spec, task, difficulty, skipped) {
   const [agent, ...rest] = spec.split(":");
-  reapSeat(ctx, agent);
   let field = rest.join(":");
   if (!field) {
     if (agent === "glm") field = "zai-coding-plan";

package/bin/crew/processes.mjs

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { call } from "./core.mjs";
+
+export const runnerRecord = (ctx, project, agent) => join(ctx.seatDir, `${project}-${agent}.runner.json`);
+
+export function seatProcesses(ctx, project, agent) {
+  if (ctx.env.CREW_NO_PROC_KILL === "1") return [];
+  let label = agent, dir = ctx.dir;
+  try {
+    const record = JSON.parse(readFileSync(runnerRecord(ctx, project, agent), "utf8"));
+    label = record.label;
+    dir = record.dir;
+  } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const rows = call("ps", ["-axo", "pid=,ppid=,command="]).stdout.split("\n").map(line => {
+    const match = line.trim().match(/^(\d+)\s+(\d+)\s+(.+)$/);
+    return match ? { pid: Number(match[1]), parent: Number(match[2]), command: match[3] } : null;
+  }).filter(Boolean);
+  const ids = new Set(rows.filter(row => row.command.endsWith(`crew-runner.mjs ${label} ${dir}`)).map(row => row.pid));
+  let before;
+  do { before = ids.size; for (const row of rows) if (ids.has(row.parent)) ids.add(row.pid); } while (ids.size > before);
+  return [...ids];
+}
+
+export function signalProcesses(pids, signal) {
+  for (const pid of pids) {
+    try { process.kill(pid, signal); } catch (error) { if (error.code !== "ESRCH") throw error; }
+  }
+}

package/bin/crew/stage.mjs

@@ -0,0 +1,28 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { setTimeout } from "node:timers/promises";
+import { loadOrCreate } from "../../lib/identity.mjs";
+import { ensureEnrolled } from "../../lib/enroll.mjs";
+import { sfetchJson } from "../../lib/signed-fetch.mjs";
+
+// A replacement registers before it touches the old runner's worktree or queue.
+export async function awaitSwapRelease(env = process.env) {
+  if (!env.CREW_SWAP_STAGE) return;
+  const stage = env.CREW_SWAP_STAGE;
+  const session = `${env.CREW_SWAP_LABEL}:${env.RELAY_PROJECT}`;
+  const identity = loadOrCreate(session, "agent");
+  const enrollment = await ensureEnrolled(env.RELAY_URL, identity, env.RELAY_PROJECT);
+  if (!enrollment.ok) throw new Error(`replacement enrollment failed: ${enrollment.reason}`);
+  const response = await sfetchJson(`${env.RELAY_URL}/register`, {
+    identity, payload: { session, project: env.RELAY_PROJECT, kind: "agent", status: "replacement ready; awaiting handoff" },
+    signal: AbortSignal.timeout(8000),
+  });
+  if (!response.ok) throw new Error(`replacement registration failed: ${response.status}`);
+  writeFileSync(`${stage}.ready`, JSON.stringify({ pid: process.pid, session }));
+  const deadline = Date.now() + 120000;
+  while (!existsSync(`${stage}.release`)) {
+    if (Date.now() > deadline) throw new Error("swap handoff timed out; replacement stopped before taking work");
+    await setTimeout(100);
+  }
+  const handoff = JSON.parse(readFileSync(`${stage}.release`, "utf8"));
+  if (handoff.agent !== env.CREW_SWAP_AGENT) throw new Error("swap release names a different seat");
+}

package/bin/crew/state.mjs

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { seatProcesses, signalProcesses } from "./processes.mjs";
 import { call, listPids, run } from "./core.mjs";
 import { hostId } from "../../lib/project.mjs";
 import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../lib/docker-janitor.mjs";
@@ -61,6 +62,7 @@ async function stopSeatContainers(ctx, project, agent) {
 async function killSeatProcesses(ctx, project, agent) {
   if (ctx.env.CREW_NO_PROC_KILL === "1" || !project || !agent) return;
   await stopSeatContainers(ctx, project, agent);
+  if (!ctx.dry) signalProcesses(seatProcesses(ctx, project, agent), "SIGKILL");
   const patterns = [`seats/${project}-${agent}\\.sh`, `crew-runner\\.mjs ${agent} .*/${project}$`];
   for (const pattern of patterns) {
     for (const pid of listPids(pattern)) run(ctx, "kill", ["-9", pid], { rendered: `kill -9 ${pid} 2>/dev/null` });

package/bin/crew/swap.mjs

@@ -0,0 +1,163 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
+import { call, commandExists } from "./core.mjs";
+import { resolveSpec } from "./models.mjs";
+import { runnerRecord, seatProcesses, signalProcesses } from "./processes.mjs";
+import { down, readRows, writeRows } from "./state.mjs";
+import { providerStatus } from "../../lib/providers.mjs";
+import { lookup } from "../../lib/model-catalog.mjs";
+import { resolveKeys } from "../../lib/provider-keys.mjs";
+import { resolveSecrets } from "../../lib/secrets.mjs";
+import { signedGet, signedPost } from "../../hooks/lib/api.mjs";
+
+const NATIVE = new Set(["codex", "kimi", "claude", "gemini", "dsh"]);
+
+export function swapOptions(args) {
+  const positional = [];
+  const options = { task: "code", difficulty: "medium", provider: "", model: "" };
+  for (let i = 0; i < args.length; i++) {
+    const key = { "--task": "task", "--difficulty": "difficulty", "--diff": "difficulty", "--provider": "provider", "--model": "model" }[args[i]];
+    if (key) {
+      if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`missing value for ${args[i]}`);
+      options[key] = args[++i];
+    } else if (args[i].startsWith("--")) throw new Error(`unknown swap flag ${args[i]}`);
+    else positional.push(args[i]);
+  }
+  const [from, replacement = options.provider ? from : ""] = positional;
+  if (!from || !replacement || positional.length > 2) throw new Error("usage: trantor swap <old> [new[:provider/model]] [--provider P] [--model M] [--json]");
+  const agent = replacement.split(":")[0];
+  if (![from, agent].every(value => /^[A-Za-z0-9_-]+$/.test(value))) throw new Error("invalid seat name");
+  return { ...options, from, replacement, agent };
+}
+
+export async function validateReplacement(ctx, options, status = providerStatus) {
+  const explicit = options.provider;
+  const field = options.replacement.split(":").slice(1).join(":");
+  const native = NATIVE.has(options.agent) && !explicit;
+  const provider = native ? options.agent : (explicit || field.split("/")[0] || (options.agent === "glm" ? "zai-coding-plan" : options.agent));
+  const binary = native ? options.agent : "opencode";
+  if (!commandExists(binary, ctx.env)) throw new Error(`${binary} CLI not found on PATH; old seat unchanged`);
+  const registryName = provider === "zai-coding-plan" ? "zai" : provider;
+  const env = resolveKeys(ctx.env, [join(ctx.home, ".token-scrooge/.env"), join(ctx.home, ".agent-bus/.env")], resolveSecrets(ctx.env));
+  const rows = await status({ env, path: env.PATH, only: [registryName] });
+  const row = rows[0];
+  if (!row || row.state !== "connected") throw new Error(`${provider}: ${row?.reason || "no credential validator available"}; old seat unchanged`);
+  const spec = explicit ? `${options.agent}-provider:${provider}${options.model ? `/${options.model}` : ""}` : options.model ? `${options.agent}:${options.model}` : options.replacement;
+  const skipped = [];
+  const seat = resolveSpec({ ...ctx, env }, spec, options.task, options.difficulty, skipped);
+  if (!seat) throw new Error(skipped.join("; "));
+  if (native && seat.model && !lookup(seat.model).found) {
+    let models = [];
+    const cache = join(ctx.home, ".codex/models_cache.json");
+    if (options.agent === "codex" && existsSync(cache)) models = JSON.parse(readFileSync(cache, "utf8")).models || [];
+    if (!models.some(model => model.slug === seat.model)) throw new Error(`cannot validate native model ${seat.model}; old seat unchanged`);
+  }
+  if (!native) {
+    const catalog = call("opencode", ["models", provider], { env });
+    const models = catalog.stdout.split(/\s+/).filter(Boolean).map(m => m.startsWith(`${provider}/`) ? m : `${provider}/${m}`);
+    if (!catalog.ok || !models.includes(seat.model)) throw new Error(`model ${seat.model} is not in ${provider}'s available catalog; old seat unchanged`);
+  }
+  return { ...seat, agent: options.agent, driver: native ? "" : "opencode" };
+}
+
+export function pendingPath(ctx, agent) { return join(ctx.home, ".agent-bus", `pending-${agent}-${ctx.project}.json`); }
+
+function readPending(ctx, agent) {
+  const file = pendingPath(ctx, agent);
+  if (!existsSync(file)) return { wake: [], bcast: [], seen: [], ask: 0, askTo: "" };
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+
+function savePending(ctx, agent, pending) {
+  const file = pendingPath(ctx, agent);
+  writeFileSync(`${file}.swap`, JSON.stringify({ ...pending, agent, project: ctx.project, ts: Date.now() }));
+  renameSync(`${file}.swap`, file);
+}
+
+async function hubRequest(ctx, path, body) {
+  const response = body
+    ? await signedPost(`${ctx.hub}${path}`, body, { project: ctx.project })
+    : await signedGet(`${ctx.hub}${path}`, { project: ctx.project });
+  if (!response.ok || !response.json?.ok) throw new Error(response.json?.error || response.reason || `hub handoff failed (${response.status})`);
+  return response.json;
+}
+
+export function swapRuntime(ctx, adapters, spawn) {
+  let pids = [];
+  let replacementPid;
+  return {
+    validate: options => {
+      if (options.agent !== options.from && readRows(ctx).some(row => row.project === ctx.project && row.agent === options.agent)) throw new Error(`replacement seat ${options.agent} already exists; old seat unchanged`);
+      return validateReplacement(ctx, options);
+    },
+    async start(seat, stage) {
+      const staged = { ...ctx, swap: { ...stage, agent: seat.agent, driver: seat.driver } };
+      spawn(staged, { ...seat, agent: stage.label });
+    },
+    async ready(stage) {
+      const deadline = Date.now() + 30000;
+      while (!existsSync(`${stage.path}.ready`)) {
+        if (Date.now() > deadline) throw new Error("replacement did not join the bus within 30s; old seat unchanged");
+        await setTimeout(100);
+      }
+      const ready = JSON.parse(readFileSync(`${stage.path}.ready`, "utf8"));
+      const response = await signedGet(`${ctx.hub}/peers?project=${encodeURIComponent(ctx.project)}`, { project: ctx.project });
+      if (!response.ok || !response.json?.peers?.some(p => p.session === ready.session)) throw new Error("replacement registration is not visible on the bus");
+      process.kill(ready.pid, 0);
+      replacementPid = ready.pid;
+      return ready.session;
+    },
+    freeze(agent) { pids = seatProcesses(ctx, ctx.project, agent); signalProcesses(pids, "SIGSTOP"); },
+    resume() { signalProcesses(pids, "SIGCONT"); },
+    transfer: body => hubRequest(ctx, "/contracts/transfer", body),
+    async stop(agent) {
+      process.kill(replacementPid, 0);
+      await down(ctx, [agent], adapters);
+      signalProcesses(pids, "SIGKILL");
+    },
+    async cancel(stage) { await down(ctx, [stage.label], adapters); },
+    release(stage, agent, cursor) {
+      writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.agent === stage.label ? { ...row, agent } : row));
+      writeFileSync(runnerRecord(ctx, ctx.project, agent), JSON.stringify({ label: stage.label, dir: ctx.dir }));
+      writeFileSync(`${stage.path}.release`, JSON.stringify({ agent, cursor }));
+    },
+  };
+}
+
+export async function performSwap(ctx, options, runtime) {
+  const result = { ok: false, action: "swap", seat: options.from, to: options.agent, moved: [] };
+  let stage, frozen = false, transferred = false;
+  try {
+    const seat = await runtime.validate(options);
+    const label = `${options.agent}-swap-${randomUUID().slice(0, 8)}`;
+    mkdirSync(ctx.seatDir, { recursive: true });
+    stage = { label, path: join(ctx.seatDir, label) };
+    await runtime.start(seat, stage);
+    const readySession = await runtime.ready(stage);
+    frozen = true;
+    await runtime.freeze(options.from);
+    const pending = readPending(ctx, options.from);
+    const target = options.agent === options.from ? pending : readPending(ctx, options.agent);
+    const from = `${options.from}:${ctx.project}`, to = `${options.agent}:${ctx.project}`;
+    const handoff = await runtime.transfer({ from, to, project: ctx.project, readySession, _op: `swap-${stage.label}`, heldAsk: pending.ask || 0, pendingIds: pending.wake.map(m => m.id) });
+    transferred = true;
+    result.moved = [...new Set([...pending.wake.map(m => m.id), ...handoff.moved])];
+    const wake = new Map([...target.wake, ...pending.wake, ...handoff.messages].map(m => [m.id, { ...m, to }]));
+    savePending(ctx, options.agent, { ...target, wake: [...wake.values()], bcast: [...new Map([...target.bcast, ...pending.bcast].map(m => [m.id, m])).values()], ask: handoff.messages.some(m => m.re === pending.ask) ? 0 : pending.ask || target.ask, askTo: pending.askTo || target.askTo });
+    await runtime.stop(options.from);
+    frozen = false;
+    if (options.agent !== options.from) savePending(ctx, options.from, { ...pending, wake: [], bcast: [], ask: 0, askTo: "" });
+    await runtime.release(stage, options.agent, handoff.cursor);
+    return { ...result, ok: true };
+  } catch (error) {
+    if (!transferred) {
+      if (frozen) await runtime.resume();
+      if (stage) await runtime.cancel(stage);
+    }
+    result.reason = error.message;
+    if (transferred) result.reason += "; handoff recorded on hub; old seat held for recovery";
+    return result;
+  }
+}

package/bin/crew-runner.mjs

@@ -16,13 +16,13 @@ import { applyWorktreeDeclaration, ensureSeatWorktree, provisioningLines, readWo
 import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
   verdictFor, substantiveOutput, stallVerdict, cutSignalFor,
-  BILLING_RE, looksLikeBillingDeath, usageSaysNoWork, zeroUsageVerdict,
+  BILLING_RE, looksLikeBillingDeath, usageSaysNoWork, zeroUsageVerdict, noDeliveryVerdict,
   permissionRejection, looksLikePermissionDeath,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt, contractBase, baseLine } from "./crew-payload.mjs";
 import {
-  cardRefs, wakeCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
+  cardRefs, servedContractCard, carriesWork, parseTurnTokens, parseResetAt, reasonWithBalances, quotaResetAt, PARKING_REASONS,
   senderProjectOf, isLinkedProject, stateSkipReason, isMessageCardTitle, OPEN_CARD_STATUSES,
   CUT_CHAIN_PARK_MIN, cutChainEvidence, isBoundedPark,
 } from "../lib/turn-policy.mjs";
@@ -41,7 +41,10 @@ import {
 import { costLine } from "../lib/state/cost.mjs";
 import { resolveStateFlags } from "../lib/state/flags.mjs";
 
-const AGENT = process.argv[2];
+import { awaitSwapRelease } from "./crew/stage.mjs";
+
+await awaitSwapRelease();
+const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
 // RELAY_PROJECT is inherited from crew.mjs (the host's resolved key); else fall
@@ -241,7 +244,8 @@ const CLI = {
 // <label>:<provider>` for any opencode vendor the user configured — run with no per-provider code
 // here; its model id arrives pre-qualified (`<provider>/<model>`) as CREW_MODEL.
 const NATIVE = new Set(["codex", "gemini", "kimi", "claude", "dsh"]);
-const cli = CLI[AGENT] || (NATIVE.has(AGENT) ? null : CLI.opencode);
+const DRIVER = process.env.CREW_SWAP_DRIVER || AGENT;
+const cli = CLI[DRIVER] || (NATIVE.has(AGENT) ? null : CLI.opencode);
 if (!cli) { console.error(`unknown agent '${AGENT}' (native: ${[...NATIVE].join(", ")}; any other name = an opencode provider seat)`); process.exit(1); }
 if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an opencode provider (BYOM)`);
 
@@ -250,7 +254,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 // parameters the CLI can carry (codex -c model_reasoning_effort / claude --effort / opencode
 // --variant) and logs ONE line saying what it set — or that the model is uncatalogued.
 const EFFORT = (() => { try { return JSON.parse(process.env.CREW_EFFORT || "null"); } catch { return null; } })();
-const EFFORT_FLAG = EFFORT ? cliEffortFlag(AGENT, EFFORT) : { flag: "", text: "" };
+const EFFORT_FLAG = EFFORT ? cliEffortFlag(DRIVER, EFFORT) : { flag: "", text: "" };
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
@@ -279,6 +283,11 @@ let lastEmptyOutput = false;
 // the CLI printed its banner and quit. The both-streams-silent rule above stays; this is the
 // second, harder-to-see empty shape.
 let lastEmptyTurn = false;
+// #10197: exit 0 on a turn BOUND to a card contract with neither a new commit nor a card move to
+// testing/done — the ibkr shape (48s, prose, card still todo, announced done). The card's status
+// at turn end rides along so the assigner's notice can name it.
+let lastNoDelivery = false;
+let lastNoDeliveryStatus = "";
 const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
 const DUTY_NUDGES = process.env.RUNNER_DUTY_NUDGES === "1";
 const DUTY_NUDGE_STATE = process.env.RUNNER_DUTY_NUDGE_STATE
@@ -612,6 +621,7 @@ const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-$
 const STATE_MODE = (() => {
   if (!STATE_FLAG_ON) return false;
   if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
+  if (DRIVER !== "claude") return false;
   const probe = hasJsonSchemaFlag((bin, args) => spawnSync(bin, args, { encoding: "utf8", timeout: 20000 }));
   if (!probe) { log(`\x1b[33m${STATE_ENV}=1 but this claude CLI has no --json-schema — state mode stays OFF (TDD §6)\x1b[0m`); return false; }
   try {
@@ -742,6 +752,16 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #7759: the worktree snapshot the turn is judged against at its end — porcelain covers edits
   // AND new untracked files, which a HEAD-only comparison misses.
   const statusBefore = gitOut(["status", "--porcelain"], TURN_DIR);
+  // #10197: the card status snapshot the turn is judged against at its end — a move to
+  // testing/done under the turn is delivery even without a commit. null = the hub read failed:
+  // the delivery check stands down rather than claim no-delivery on a transport error.
+  let cardStatusBefore = null;
+  if (!opts.state && sessionCard > 0) {
+    try {
+      const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
+      cardStatusBefore = task ? String(task.status || "") : null;
+    } catch { cardStatusBefore = null; }
+  }
   // #9778: the docker snapshot the turn is judged against — containers the CLI spawns are recorded
   // against the seat's card at turn end, then stopped when the card closes or the seat parks.
   const dockerBefore = listContainers();
@@ -1011,16 +1031,38 @@ exit $turn_exit`;
     effExit = 1;
     log("\x1b[31mexit 0 but the session usage record resolved to all zeros — no model work happened; treating as FAILED\x1b[0m");
   }
+  // #10197: a turn BOUND to a card contract reads done only on DELIVERY — a NEW commit since the
+  // turn started, or the card moved to testing/done under it. The ibkr shape (exit 0, output, no
+  // commit, card still todo) is NO-DELIVERY: the ledger names it and the contract stays owed.
+  // Judged on hub reads of the card status; a failed read keeps today's label, never no-delivery.
+  let cardStatusAtEnd = "", noDelivery = false;
+  if (!cut && !opts.state && realExit === 0 && effExit === 0 && sessionCard > 0 && cardStatusBefore !== null) {
+    let endStatus = null;
+    try {
+      const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${sessionCard}`);
+      endStatus = task ? String(task.status || "") : null;
+    } catch { endStatus = null; }
+    if (endStatus !== null) {
+      cardStatusAtEnd = endStatus;
+      const moved = ["testing", "done"].includes(endStatus) && !["testing", "done"].includes(cardStatusBefore);
+      noDelivery = !newCommit && !moved;
+    }
+  }
+  lastNoDelivery = noDelivery;
+  lastNoDeliveryStatus = cardStatusAtEnd;
+  if (noDelivery) log(`\x1b[33mexit 0 but the turn DELIVERED NOTHING on #${sessionCard} — no new commit, card still ${cardStatusAtEnd || "unknown"}\x1b[0m`);
   // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
   // away — the same "classified X because Y" shape the runner logs. A silent cut names its own
   // verdict (#7752): the exit under it is the sweep's SIGPIPE. A box cut passes `cut` so its 137
   // reads as the sweep's SIGKILL (#7099); a zero-usage turn names its own verdict too (#9724).
-  const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict() : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
+  const verdict = stallCut ? stallVerdict() : zeroUsage ? zeroUsageVerdict()
+    : noDelivery ? noDeliveryVerdict(sessionCard, cardStatusAtEnd || "unknown")
+    : verdictFor(realExit, effExit, lastEmptyOutput, ownOut, lastEmptyTurn, cut);
   // #6289: every ledger row names in ONE field what happened to the turn — cut, stalled (#7752),
   // api-error, completed — and what it cost (0 means "not reported", never "free"). #7762: `card`
   // binds the row to the card the turn worked (0 = kickoff/pulse) so the seat record attributes
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
-  const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : lastEmptyTurn ? "empty" : "completed");
+  const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
   // #7756: a clean turn that ASKED its assigner is demoted-but-owed, not "completed". The judge
   // (deliverWake's /contracts read) renames the ledger row, so "asked" is what the log keeps.
   let finalOutcome = outcome;
@@ -1251,7 +1293,9 @@ async function newestOwnCard(session, why) {
   } catch { return 0; }   // board unreadable: no binding beats a guessed one
 }
 async function resolveWakeCard(messages, { session }) {
-  const cited = wakeCard(messages, { session });
+  // #10824: the contract message BEING SERVED names the card — the newest direct message's own
+  // binding — never a contract still queued behind it and never the session's previous card.
+  const cited = servedContractCard(messages, { session });
   if (!(cited > 0)) return 0;
   try {
     const { task } = await api(`/card?project=${encodeURIComponent(PROJ)}&id=${cited}`);
@@ -1265,7 +1309,8 @@ async function resolveWakeCard(messages, { session }) {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
   let cursor = 0;
-  try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
+  if (process.env.CREW_SWAP_STAGE) cursor = JSON.parse(readFileSync(`${process.env.CREW_SWAP_STAGE}.release`, "utf8")).cursor;
+  else try { const r = await api(`/inbox?session=${encodeURIComponent(SESSION)}&since=0`); cursor = r.cursor || 0; } catch {}
   // kind "agent" on every beat (#6075): the peer row's kind is the hub's OWN record of what a
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
   // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an
@@ -1312,6 +1357,7 @@ async function resolveWakeCard(messages, { session }) {
   }
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
+  let noDeliveryRetry = false;
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
   // #7060: the turn the boot line was read as a promise about. It is a transcript turn by
@@ -1455,6 +1501,12 @@ async function resolveWakeCard(messages, { session }) {
     // a bounded park instead of queueing behind the window; a mention does not, because the room
     // talking is not a request. An exhausted or auth park is a wall and stands anyway (#6134).
     const directWake = wake.filter(m => m.to === SESSION);
+    // #10197: no-delivery owes the old contract, but its retry delay must not batch away
+    // fresh contracts. Only actual CLI failures impose backoff on a new wake.
+    if (noDeliveryRetry) {
+      unpark("new wake after no-delivery");
+      retryAt = 0; deliveryFails = 0; noDeliveryRetry = false;
+    }
     if (parkState && directWake.length) {
       if (isBoundedPark(parkState.reason)) {
         unpark(`direct message from ${directWake[0].from || "?"}`);
@@ -1491,6 +1543,7 @@ async function resolveWakeCard(messages, { session }) {
     } catch { return 0; }
   }
   async function deliverWake() {
+    noDeliveryRetry = false;
     // #7756: captured and cleared HERE so an early return below never leaks the flag into a
     // later turn — only the turn the answer released reads it.
     const resumedAfterAsk = askReleased;
@@ -1560,12 +1613,13 @@ async function resolveWakeCard(messages, { session }) {
     // #6134: ONE SESSION PER CARD; a different card starts a fresh CLI session and the seat is told.
     // #7061: bound by SHAPE, not position, so an order opening with what shipped binds the right card.
     // #7763: a message-card (or phantom) citation never binds — the seat's own newest card does.
-    const card = await resolveWakeCard(wakeForTurn, { session: SESSION });
+    // #10824: the binding is the SERVED contract's; #7756's answer-released turn keeps the held card.
+    const card = resumedAfterAsk ? sessionCard : await resolveWakeCard(wakeForTurn, { session: SESSION });
     // #7754: a `base:` sha this worktree cannot resolve is never worked from origin/main — the card
     // goes to blocked, the assigner is told, and no model turn is spent. The check keeps the id the
-    // wake cites in its text: #7763's rebinding covers confirmed message-card ids only, never a
+    // served contract cites: #7763's rebinding covers confirmed message-card ids only, never a
     // card cited in the text, so the unresolvable-base branch blocks the cited card.
-    const baseCard = card || wakeCard(wakeForTurn, { session: SESSION });
+    const baseCard = card || servedContractCard(wakeForTurn, { session: SESSION });
     const base = contractBase(wakeForTurn) || localMainHead();
     if (base && baseCard && !resolvesHere(base)) {
       const text = `cannot resolve base ${base} in ${TURN_DIR} (git cat-file -e failed) — #${baseCard} moved to blocked; push or fetch that sha, or name one this worktree can reach`;
@@ -1579,13 +1633,13 @@ async function resolveWakeCard(messages, { session }) {
       return;
     }
     const baseText = base ? `\n${baseLine(base)}\n` : "";
-    // #6289: the card the SESSION belongs to reads the citation when the rebinding binds nothing —
-    // #7763 decides WHICH card work binds to, never the turn shape. #7756: the turn an ask's
-    // ANSWER releases is the exception — it resumes the session the held contract already owns,
-    // whatever card the batch cites; only a new contract for a different card opens fresh.
+    // #6289: the session SHAPE (fresh vs resume) reads the served contract's raw citation — a wake
+    // whose card the board lacks still opens fresh, never a bare resume of the kickoff's CLI.
+    // #10824: the LABEL is the binding, 0 included — a wake that binds nothing labels its turn 0
+    // and never inherits the previous contract's card (#10197's judge then reads the right card).
     const sessionCardForTurn = card || baseCard;
     const fresh = !resumedAfterAsk && sessionCardForTurn > 0 && sessionCardForTurn !== sessionCard;
-    if (card) sessionCard = card;
+    sessionCard = card;
     const cited = [...new Set(wakeForTurn.flatMap(m => cardRefs(m.text)))];
     const freshText = fresh
       ? `\n(FRESH SESSION for card #${card} — you are not the session that worked earlier cards and you remember none of them. Read your card first: relay_board with card:${card}.)\n`
@@ -1602,6 +1656,7 @@ async function resolveWakeCard(messages, { session }) {
     const stopDutyNudgeWatcher = startDutyNudgeWatcher(dutyPlan, tStart);
     let ec;
     turnAsk = null;   // #7756: the judge reads THIS turn's ending, never a previous turn's ask
+    lastNoDelivery = false; lastNoDeliveryStatus = "";   // #10197: runTurn judges THIS turn only
     const stateStep = !stateSkip("wake", card);
     try {
       ec = stateStep
@@ -1723,6 +1778,27 @@ async function resolveWakeCard(messages, { session }) {
       savePending(pendingWake, pendingBcast);
       await reportHealthy();
       log(`turn asked its assigner — holding the contract until ask #${awaitingAsk.id} is answered`);
+    } else if (lastNoDelivery) {
+      // #10197: the turn exited 0 but DELIVERED NOTHING on its card — no new commit, the card
+      // still short of testing/done. "⚠ no commit" is not a receipt, so the sender's ledger keeps
+      // the contract owed; the queue is kept and the ladder retries — a second no-delivery
+      // attempt parks, exactly like the empty-turn ladder it sits beside.
+      deliveryFails++;
+      noDeliveryRetry = true;
+      savePending(pendingWake, pendingBcast);
+      const still = lastNoDeliveryStatus || "unresolved";
+      if (deliveryFails >= 2) {
+        retryAt = await parkSeat("no-delivery", pendingWake.length);
+        await notifyAssigners(assigners,
+          `⛔ your contract is PARKED on ${SESSION} (no-delivery: two exit-0 turns with no commit and card #${sessionCard} unmoved) · asked: "${asked}"`);
+        lastTurnAt = Date.now();
+        return;
+      }
+      const wait = RETRY_MS[Math.min(deliveryFails - 1, RETRY_MS.length - 1)];
+      retryAt = Date.now() + wait;
+      log(`\x1b[33mno commit, card #${sessionCard} still ${still} — wake not consumed, ${pendingWake.length} message(s) stay owed; retrying in ${Math.round(wait / 1000)}s\x1b[0m`);
+      await notifyAssigners(assigners,
+        `⚠ no commit, card #${sessionCard} still ${still} on ${SESSION} (exit 0, ${secs}s) · asked: "${asked}"`);
     } else if (lastEmptyTurn) {
       // #7759: the turn exited 0 but was HOLLOW — a banner is not work. The wake is NOT
       // consumed: the queue is kept and the ladder retries, and the assigner hears EMPTY,

package/bin/crew.mjs

@@ -5,7 +5,9 @@ import { createCmuxAdapter, spawnCmux } from "./crew/cmux.mjs";
 import { createHerdrAdapter, spawnHerdr } from "./crew/herdr.mjs";
 import { resolveSpec, reportSkipped } from "./crew/models.mjs";
 import { openOrchestrator } from "./crew/open.mjs";
-import { down, prune } from "./crew/state.mjs";
+import { performSwap, swapOptions, swapRuntime } from "./crew/swap.mjs";
+import { redactKeys } from "../lib/redact.mjs";
+import { reapSeat, down, prune } from "./crew/state.mjs";
 import { spawnTerminal, spawnTmux } from "./crew/tmux.mjs";
 import { epochMs, failedAgents, verifyCrew } from "./crew/verify.mjs";
 import { guardCrossProjectUp } from "./crew/worktrees.mjs";
@@ -13,10 +15,21 @@ import { preflightFirstSeat } from "./crew/preflight.mjs";
 import { resolveAgentLaunchSpecs } from "../lib/agent-preferences.mjs";
 import { readConfig } from "../lib/project.mjs";
 
-const [command = "up", ...rawArgs] = process.argv.slice(2);
+const [command = "up", ...inputArgs] = process.argv.slice(2);
+const jsonMode = inputArgs.includes("--json");
+const rawArgs = inputArgs.filter(arg => arg !== "--json");
+const output = console.log.bind(console);
+const diagnostics = [];
+if (jsonMode) console.log = (...parts) => {
+  const line = redactKeys(parts.join(" "));
+  diagnostics.push(line);
+  console.error(line);
+};
+const jsonResult = (code, extra = {}) => ({ ok: code === 0, action: command, seat: resultSeat, moved: [], ...extra });
+let resultSeat = rawArgs.filter(a => !a.startsWith("--")).join(",");
 let ctx;
 try { ctx = createContext(command); }
-catch (error) { console.error(error.message); process.exit(1); }
+catch (error) { if (jsonMode) output(JSON.stringify(jsonResult(1, { reason: redactKeys(error.message) }))); else console.error(error.message); process.exit(1); }
 
 const adapters = {
   cmux: createCmuxAdapter(ctx),
@@ -39,7 +52,11 @@ function parseUpArgs(args) {
 }
 
 function spawnCrew(options, skipped) {
-  const resolve = spec => resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+  const resolve = spec => {
+    const seat = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+    if (seat) reapSeat(ctx, seat.agent);
+    return seat;
+  };
   const pruneNow = () => prune(ctx, adapters);
   if (ctx.mux === "herdr") spawnHerdr(ctx, options.specs, resolve, pruneNow);
   else if (ctx.mux === "cmux") spawnCmux(ctx, options.specs, resolve, pruneNow);
@@ -56,6 +73,7 @@ async function runUp(args, verify = true) {
   const options = parseUpArgs(args);
   const requested = resolveAgentLaunchSpecs(options.specs, readConfig());
   options.specs = requested.specs;
+  resultSeat = options.specs.map(spec => spec.split(":")[0]).join(",");
   if (!options.specs.length) {
     console.log("usage: crew.mjs up [--task K --difficulty D] codex glm kimi deepseek (or set a default in Settings → Agents)");
     return 1;
@@ -95,25 +113,42 @@ async function runUp(args, verify = true) {
   return reportSkipped(skipped);
 }
 
+function spawnReplacement(context, seat) {
+  const resolve = () => seat;
+  const specs = [seat.agent];
+  const noPrune = () => {};
+  if (context.mux === "herdr") spawnHerdr(context, specs, resolve, noPrune);
+  else if (context.mux === "cmux") spawnCmux(context, specs, resolve, noPrune);
+  else if (context.mux === "tmux") spawnTmux(context, specs, resolve);
+  else spawnTerminal(context, specs, resolve);
+}
+
 async function swap(args) {
-  const [oldAgent, replacement, ...flags] = args;
-  if (!oldAgent || !replacement) {
-    console.log("usage: trantor swap <oldAgent> <newAgent[:provider[/model]]> [--task K --difficulty D]");
-    return 1;
-  }
-  console.log(`— tearing down old seat '${oldAgent}' in ${ctx.project} —`);
-  await down(ctx, [oldAgent], adapters);
-  console.log(`— spawning replacement: ${replacement} —`);
-  const code = await runUp([...flags, replacement]);
-  if (!code) console.log(`— swapped. RESEND the contract to '${replacement.split(":")[0]}' (it joined fresh with no context). —`);
-  return code;
+  const options = swapOptions(args);
+  resultSeat = options.from;
+  if (resolveAgentLaunchSpecs([options.replacement], readConfig()).disabled.length) throw new Error(`replacement ${options.agent} is disabled in agent settings`);
+  if (!guardCrossProjectUp(ctx)) throw new Error("cross-project swap refused");
+  if (ctx.dry) throw new Error("swap requires a live bus; dry-run cannot verify a handoff");
+  return performSwap(ctx, options, swapRuntime(ctx, adapters, spawnReplacement));
 }
 
 let code = 0;
-if (command === "down") code = await down(ctx, rawArgs, adapters);
-else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
-else if (command === "open") code = openOrchestrator(ctx, rawArgs);
-else if (command === "swap") code = await swap(rawArgs);
-else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
-else { usage(); code = 1; }
+let result;
+try {
+  if (command === "down") code = await down(ctx, rawArgs, adapters);
+  else if (command === "prune") { prune(ctx, adapters); console.log(`— pruned dead crew rows (${ctx.statePath}) —`); }
+  else if (command === "open") code = openOrchestrator(ctx, rawArgs);
+  else if (command === "swap") { result = await swap(rawArgs); code = result.ok ? 0 : 1; }
+  else if (command === "up") code = guardCrossProjectUp(ctx) ? await runUp(rawArgs) : 1;
+  else { usage(); code = 1; }
+} catch (error) {
+  code = 1;
+  result = jsonResult(code, { reason: redactKeys(error.message) });
+}
+if (!result) result = jsonResult(code);
+if (!result.ok && !result.reason) result.reason = diagnostics.at(-1) || `${command} failed; see stderr`;
+if (result.reason) result.reason = redactKeys(result.reason);
+if (jsonMode) output(JSON.stringify(result));
+else if (result.reason) console.error(result.reason);
+else if (command === "swap") console.log(`— swapped ${result.seat} → ${result.to}; moved contracts: ${result.moved.join(", ") || "none"} —`);
 process.exit(code);

package/bin/summarize.mjs

@@ -1,18 +1,8 @@
 #!/usr/bin/env node
-// trantor summarize — narrative cards: what was ASSIGNED and what was DONE, in plain language.
-//
-//   trantor summarize [--project <p>] [--limit N] [--all] [--dry] [--quiet]
-//
-// Title-cleaning makes machine-generated cards readable; it cannot make them MEAN anything. This
-// gives each card a one-line narrative ("assigned — did") written by a CHEAP model from the card's
-// own thread (its events + the messages that cite it). The board then reads as a story a human can
-// follow, which was the ask: "what the agent was assigned, what the agent did, what the flow was."
-//
-// Economics by design (the Scrooge doctrine): candidates are MACHINE-TITLED cards without a
-// summary (--all widens to every unsummarized card), batched into ONE cheap-model call per hub,
-// difficulty easy, capped per run. The summary lands via /task/update and rides the tasks.extra
-// column — permanent, never recomputed. Runs ambiently from the heartbeat (hourly, detached) and
-// on demand as `trantor summarize`.
+// trantor summarize [--project <p>] [--limit N] [--all] [--dry] [--quiet] — gives each machine-titled
+// card a one-line "assigned — did" narrative written by ONE cheap-model call per hub from the card's
+// own thread; lands via /task/update on tasks.extra (permanent, never recomputed). Runs ambiently
+// from the heartbeat (hourly, detached) and on demand as `trantor summarize`.
 import { execSync, spawnSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
@@ -40,7 +30,7 @@ const scroogeBin = () => process.env.SCROOGE_BIN
 // A title no human wrote: protocol frames, dumped prompts, id soup. These are the cards whose
 // board presence is noise until a narrative replaces them.
 const machineTitled = (t) =>
-  /^\s*[<{[]/.test(t) || /<task-notification>|<system-reminder>|toolu_[A-Za-z0-9]/.test(t) ||
+  /^\s*[<{[]/.test(t) || /<task-notification>|<system-reminder>|<trantor-succession>|<trantor-takeover>|toolu_[A-Za-z0-9]/.test(t) ||
   /^\s*(subagent|general-purpose|Explore|Task|Plan):/i.test(t) || t.length > 130;
 
 const hubs = new Set([config.url || "http://127.0.0.1:4477", ...Object.values(config.hubs || {})]);

package/hooks/heartbeat.mjs

@@ -119,10 +119,12 @@ async function maybeEarlyWarn(stdinRaw, session) {
     // It is marked where the baton fires (here on the backstop, in Stop on the normal path).
     armBaton(sessionId, { projectDir, transcript, reason: "context-warn", windowId, tty, tokens: usage.tokens });
     // Tell the RUNNING agent (once, at arm time): wrap up and author the boundary handoff yourself.
-    ARM_CTX = `<system-reminder>TRANTOR SUCCESSION ARMED — this session is at ${Math.round(usage.frac * 100)}% of its context window, and the baton is armed: your NEXT STOP fires the handoff. You are now responsible for your own succession:\n`
+    // NOT <system-reminder>: CC 2.1.292 escapes that tag in hook output, so the notice would
+    // arrive as literal text (#11110). Our own <trantor-…> tags pass through like the other hooks'.
+    ARM_CTX = `<trantor-succession>TRANTOR SUCCESSION ARMED — this session is at ${Math.round(usage.frac * 100)}% of its context window, and the baton is armed: your NEXT STOP fires the handoff. You are now responsible for your own succession:\n`
       + `1. Reach a real task boundary — finish, pause, or checkpoint your in-flight work NOW; do not start new work.\n`
       + `2. Author (or refresh) the rich handoff from your CURRENT state — via the handoff skill or the relay_handoff MCP tool — so the successor gets the freshest picture, not a digest of a session 36 seconds stale. A fresh model-authored handoff supersedes the auto-digest.\n`
-      + `3. Then end your turn. The Stop hook fires the baton at that boundary.</system-reminder>`;
+      + `3. Then end your turn. The Stop hook fires the baton at that boundary.</trantor-succession>`;
   } catch {}
 }
 

package/hooks/prompt-focus.mjs

@@ -18,6 +18,25 @@ function readStdin() {
 }
 // A prompt that is JUST an acknowledgement/continuation (anchored to end) — not a new focus.
 const ACK = /^(y|yes|yep|yeah|ok|okay|sure|go|go ahead|continue|proceed|do it|please|thanks|thank you|ty|next|k|cool|nice|great|perfect|sounds good|👍)[\s.!]*$/i;
+// A paste arrives wrapped in `<pasted_content id="…">…</pasted_content>`: the wrapper is transport,
+// not content — the operator typed what is inside (#10027's chat.rs rule, same channel). Peel it so
+// the marker check and the focus title see the words, never the tag. Unwrapped text passes through.
+function unwrapPasted(t) {
+  const s = String(t || "").trim();
+  if (!s.startsWith("<pasted_content")) return s;
+  const gt = s.indexOf(">");
+  if (gt < 0) return s;
+  const close = s.lastIndexOf("</pasted_content>");
+  return (close > gt ? s.slice(gt + 1, close) : s.slice(gt + 1)).trim();
+}
+// HARNESS-INJECTED prompts are not a human's focus. A CLOSED list of known prefixes, not "starts
+// with <": a paste merely happens to start with a tag, and a human quoting JSON is still a human.
+// (The old ^\s*[<{[] heuristic silently dropped every pasted operator prompt, #11110.)
+const HARNESS_MARKERS = [
+  "<task-notification", "<system-reminder", "<teammate-message",
+  "<command-name", "<environment_context", "[SYSTEM NOTIFICATION",
+];
+const isHarnessInjection = (t) => HARNESS_MARKERS.some(m => t.startsWith(m));
 function titleFrom(prompt) {
   let s = String(prompt || "").replace(/\s+/g, " ").trim();
   // strip a leading politeness/imperative wrapper so the card reads as the WORK, not "can you please…"
@@ -42,7 +61,7 @@ function loadRecapCtx(sessionId) {
     const mandate = rec.mode === "unattended"
       ? " Then RESUME the handoff's OPEN THREADS immediately — they are your work order; this succession is unattended, do NOT wait for the user."
       : " Then WAIT for the user.";
-    return `<system-reminder>You took over via handoff ${rec.handoffId}. If you have not yet recapped it, your reply MUST begin with the ≤3-sentence recap (task, state, next step) before anything else — including before answering this message.${mandate}</system-reminder>`;
+    return `<trantor-takeover>You took over via handoff ${rec.handoffId}. If you have not yet recapped it, your reply MUST begin with the ≤3-sentence recap (task, state, next step) before anything else — including before answering this message.${mandate}</trantor-takeover>`;
   } catch { return ""; }
 }
 function emitAndExit() {
@@ -61,17 +80,16 @@ try {
   // don't card home-dir sessions (matches sessionstart's phantom-project guard)
   if (!process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && cwd === homedir()) { emitAndExit(); }
   const trimmed = prompt.replace(/\s+/g, " ").trim();
+  const text = unwrapPasted(trimmed);   // a paste's wrapper is transport; judge the words inside
   // skip empties, tiny continuations, and pure acks — they're not a new focus
-  if (!trimmed || trimmed.length < 12 || ACK.test(trimmed)) { emitAndExit(); }
+  if (!text || text.length < 12 || ACK.test(text)) { emitAndExit(); }
   // The Accounts ask drill launches a real Claude session, so its scripted prompt traverses this
   // hook just like operator work. It is harness traffic, though, and must never become a focus card.
-  if (/\bTRANTOR ASK DRILL\b/.test(trimmed)) { emitAndExit(); }
-  // HARNESS-INJECTED prompts are not a human's focus. Task notifications, hook system-reminders and
-  // protocol frames arrive through the same UserPromptSubmit channel, and carding one titled a board
-  // card "<task-notification> <task-id>bavlqfmzq</task-id>…" — pure noise a human cannot read.
-  if (/^\s*[<{[]/.test(trimmed) || /<task-notification>|<system-reminder>|<teammate-message/i.test(trimmed)) {
-    emitAndExit();
-  }
+  if (/\bTRANTOR ASK DRILL\b/.test(text)) { emitAndExit(); }
+  // Task notifications, hook reminders and protocol frames arrive through the same UserPromptSubmit
+  // channel, and carding one titled a board card "<task-notification> <task-id>bavlqfmzq</task-id>…"
+  // — pure noise a human cannot read.
+  if (isHarnessInjection(text)) { emitAndExit(); }
   const project = resolveProject(cwd);
   const session = process.env.RELAY_SESSION
     || (process.env.RELAY_AGENT ? `${process.env.RELAY_AGENT}:${project}` : `${hostId()}:${project}`);
@@ -79,18 +97,18 @@ try {
   // two Claude sessions in one project share (and fight over) a single focus card, and sub-agent
   // cards, whose `parent` is exactly this UUID, have nothing to nest under.
   const cc = String(input.session_id || "").slice(0, 120);
-  const r = await signedPost("/focus", { session, project, title: titleFrom(trimmed), by: session, cc }, { session });
+  const r = await signedPost("/focus", { session, project, title: titleFrom(text), by: session, cc }, { session });
 
   // Only pay a model when the heuristic actually mangles the prompt. A short, already-clear ask
   // ("fix the login redirect") reads fine as-is and buying a rewrite for it is exactly the kind of
   // reflexive spend the economics doctrine exists to stop.
   const id = r?.json?.id;
-  if (id && trimmed.length > 90 && process.env.TRANTOR_NO_SCROOGE_TITLES !== "1") {
+  if (id && text.length > 90 && process.env.TRANTOR_NO_SCROOGE_TITLES !== "1") {
     try {
       const busDir = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
       mkdirSync(busDir, { recursive: true });
       const pf = join(busDir, `focus-prompt-${String(cc || session).replace(/[^A-Za-z0-9_.-]/g, "_")}.txt`);
-      writeFileSync(pf, trimmed);
+      writeFileSync(pf, text);
       const worker = join(dirname(dirname(fileURLToPath(import.meta.url))), "bin", "focus-title.mjs");
       // Detached + unref'd + stdio ignored: the hook returns NOW. Nothing downstream waits on this,
       // and a worker that dies takes the heuristic title with it, which is a fine outcome.

package/hub/routes/cards.mjs

@@ -6,6 +6,15 @@ const SLIM_DROP = new Set(["log", "history", "checklist"]);
 // #7968: the shape hollow-move.mjs posts — { base, changed[], unindexed[], dependents } or
 // { unavailable: true }; anything else is dropped so a stray payload cannot bloat the log.
 const BLAST_PATHS_MAX = 40;
+// #11142: the fleet-wide cap evicts done/stale cards oldest-first, never an open one.
+const TASK_CAP = 2000, TASK_TRIM_TO = 1750;
+const EVICTABLE = new Set(["done", "stale"]);
+function trimTasks(state) {
+  if (state.tasks.length <= TASK_CAP) return;
+  let drop = state.tasks.length - TASK_TRIM_TO;
+  state.tasks = state.tasks.filter(t => drop <= 0 || !EVICTABLE.has(t.status) || (drop--, false));
+}
+
 function cleanBlast(v) {
   if (!v || typeof v !== "object" || Array.isArray(v)) return null;
   if (v.unavailable) return { unavailable: true };
@@ -153,7 +162,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           by: b.by || "", ts: ts0, updated: ts0, history: [{ to: target, by: b.by || "", ts: ts0 }] };
         if (bgId) bt._aid = bgId; if (b.agentType) bt._atype = String(b.agentType).slice(0, 40);
         appendTaskNote(bt, b, ts0);
-        state.tasks.push(bt); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+        state.tasks.push(bt); trimTasks(state);
         appendCardEvent("created", bt, b.by, null, target);
         markDirty(); return json(res, 200, { ok: true, task: bt, created: true });
       }
@@ -180,7 +189,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
       { const dr = cleanDrill(b.drill); if (dr) t.drill = dr; }                        // #6452 — the card's drill line, rides `extra`
       if (b.source === "cc-subagent") { t._fp = subFp(b.title); if (b.agentType) t._atype = String(b.agentType).slice(0, 40); if (b.agentId) t._aid = String(b.agentId).slice(0, 80); if (b.parent) t.parent = String(b.parent).slice(0, 120); t.count = 1; if (t.status === "doing") { t._everStarted = true; t._inflight = 1; } }
       appendTaskNote(t, b, ts0);
-      state.tasks.push(t); if (state.tasks.length > 2000) state.tasks.splice(0, 500);
+      state.tasks.push(t); trimTasks(state);
       appendCardEvent("created", t, b.by, null, st0);
       // A COMMIT closes the focus. A focus card says "this session is working on X right now"; the
       // commit is X arriving, so the card that was rolling forever now completes with the commit
@@ -330,7 +339,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
         if (seen.has(t.todoKey) || t.status === "done") continue;   // keep accomplished work on the board
         state.tasks = state.tasks.filter(x => x.id !== t.id); appendCardEvent("deleted", t, session, null, null); markDirty();
       }
-      if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+      trimTasks(state);
       return json(res, 200, { ok: true, count: todos.length });
     }
     // A REGULAR session's live "focus" card — what THIS session is working on right now, set from each
@@ -375,7 +384,7 @@ export async function routeCards({ req, res, q, P, auth, ctx }) {
           history: [{ to: "doing", by: session, ts: now() }] };
         state.tasks.push(t); appendCardEvent("created", t, session, null, "doing");
         appendEvent("focus", project, session, { taskId: t.id, title, shift: false });
-        if (state.tasks.length > 2000) state.tasks.splice(0, state.tasks.length - 2000);
+        trimTasks(state);
       }
       markDirty(); return json(res, 200, { ok: true, id: t.id, task: t });
     }

package/hub/routes/contract-transfer.mjs

@@ -0,0 +1,58 @@
+function heldMessages(ctx, source, project, pendingIds) {
+  const ids = new Set(pendingIds);
+  const senders = new Set(ctx.state.messages.filter(m => m.to === source && m.project === project).map(m => m.from));
+  for (const sender of senders) {
+    for (const contract of ctx.contractsFor(sender, { project, windowMs: Number.MAX_SAFE_INTEGER })) {
+      if (contract.to !== source) continue;
+      if (!contract.answered && !["ack", "superseded"].includes(contract.disposition)) ids.add(contract.id);
+    }
+  }
+  return ctx.state.messages.filter(m => ids.has(m.id) && m.to === source && m.project === project);
+}
+
+export async function routeContractTransfer({ req, res, q, P, auth, ctx }) {
+  if (P !== "/contracts/transfer") return false;
+  if (!["GET", "POST"].includes(req.method)) return ctx.json(res, 405, { error: "GET or POST required" });
+  const b = req.method === "POST" ? await ctx.body(req) : q;
+  const { from, to, project } = b;
+  if (!project || !from || !to || !from.endsWith(`:${project}`) || !to.endsWith(`:${project}`)) {
+    return ctx.json(res, 400, { error: "source and replacement must belong to the named project" });
+  }
+  const signer = auth?.identity?.name;
+  if (signer && !signer.endsWith(`:${project}`) && auth.identity.kind !== "human") {
+    return ctx.json(res, 403, { error: "swap must be requested from its project" });
+  }
+  // #11221: a seat may never move another seat's work; only the orchestrator or a human swaps.
+  if (signer && auth.identity.kind !== "human" && ctx.state.peers[signer]?.kind !== "orch") {
+    return ctx.json(res, 403, { error: "only the project's orchestrator or a human can swap seats" });
+  }
+  const messages = heldMessages(ctx, from, project, b.pendingIds || []);
+  if (req.method === "GET") return ctx.json(res, 200, { ok: true, messages });
+  if (!ctx.state.peers[b.readySession]?.lastSeen || ctx.state.peers[b.readySession].project !== project) {
+    return ctx.json(res, 409, { error: "replacement has not registered on this project's bus" });
+  }
+  // IDs and original senders survive the move, so replies settle the assigner's original ledger.
+  for (const message of messages) message.to = to;
+  const ids = new Set(messages.map(m => m.id));
+  for (const message of ctx.state.messages) {
+    if (message.project !== project) continue;
+    if (message.kind === "ask" && message.from === from && (ids.has(message.re) || message.id === b.heldAsk)) {
+      message.from = to;
+      for (const answer of ctx.state.messages) {
+        if (answer.re !== message.id || answer.to !== from) continue;
+        answer.to = to;
+        if (!ids.has(answer.id)) { messages.push(answer); ids.add(answer.id); }
+      }
+    }
+  }
+  for (const card of ctx.state.tasks) {
+    if (card.project !== project || card.assignee !== from || !["todo", "doing", "testing", "blocked", "failed"].includes(card.status)) continue;
+    card.assignee = to;
+    card.updated = ctx.now();
+    ctx.appendTaskLog(card, signer || from, `swap reassigned ${from} → ${to}`);
+    ctx.appendCardEvent("updated", card, signer || from);
+  }
+  ctx.appendEvent("crew.swap", project, signer || from, { from, to, moved: [...ids] });
+  ctx.markDirty();
+  return ctx.json(res, 200, { ok: true, moved: [...ids], messages, cursor: ctx.state.seq });
+}

package/hub/routes/messages.mjs

@@ -1,7 +1,9 @@
 /* oxlint-disable anti-slop/no-conditional-empty-object-spread -- SAFETY: Optional message fields must remain absent, not undefined; preserving the existing spread keeps the signed wire shape identical. */
+import { routeContractTransfer } from "./contract-transfer.mjs";
 import { setTimeout, setInterval, clearInterval } from "node:timers";
 
 export async function routeMessages({ req, res, q, P, auth, ctx }) {
+  if (await routeContractTransfer({ req, res, q, P, auth, ctx })) return true;
   const {
     state, body, json, stripNulText, crossProjectGuard, touch, pushToStreams,
     appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,

package/lib/classify-failure.mjs

@@ -200,6 +200,13 @@ export function zeroUsageVerdict() {
   return "classified zero-usage because the session usage record resolved to all zeros — no model work happened";
 }
 
+/** #10197: the verdict line for a card-bound turn that DELIVERED NOTHING — exit 0 with output but
+ *  no new commit since turn start and the card unmoved (the ibkr specimen: 48s, prose, card still
+ *  todo, announced done). Named here so the drill pins the string. */
+export function noDeliveryVerdict(card, status) {
+  return `classified no-delivery because exit 0 with no new commit and card #${card} still ${status}`;
+}
+
 /** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
  *  runner logs, so the next misclassification is diagnosable from the seat log alone. `cut` is the
  *  runner's box/stall marker: 137 reads as the sweep's SIGKILL only under it — without the marker

package/lib/turn-policy.mjs

@@ -53,6 +53,29 @@ export function assignedCardRef(text) {
   return m ? Number(m.slice(1).find((g) => g != null)) : 0;
 }
 
+/// #10824: the CONTRACT MESSAGE BEING SERVED decides the card — the newest direct message's own
+/// binding: a hub-stamped `card` field, else the id its own text ASSIGNS (#7061 shape), else its
+/// first citation — never a contract queued behind it or the previous turn's card. Deference: a
+/// newest message that re-cites an older assignment is commentary on it, and #7061's reading stands.
+export function servedContractCard(messages, { session = "" } = {}) {
+  const all = (Array.isArray(messages) ? messages : []).filter(Boolean);
+  if (!all.length) return 0;
+  const direct = session ? all.filter((m) => m.to === session) : [];
+  if (!direct.length) return wakeCard(all, { session });
+  const sorted = newestLast(direct);
+  const served = sorted[sorted.length - 1];
+  const stamped = Number(served?.card);
+  if (Number.isFinite(stamped) && stamped > 0) return stamped;
+  const own = assignedCardRef(served?.text);
+  if (own) return own;
+  const named = cardRefs(served?.text);
+  if (named.length) {
+    const olderAssigned = new Set(sorted.slice(0, -1).map((m) => assignedCardRef(m?.text)).filter(Boolean));
+    if (!named.some((c) => olderAssigned.has(c))) return named[0];
+  }
+  return wakeCard(all, { session });
+}
+
 /// #7061: the card a wake batch binds to. Direct messages outrank @mentions, the NEWEST assignment wins,
 /// and only an assignment-free batch falls back to the newest message's first citation.
 export function wakeCard(messages, { session = "" } = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.77",
+  "version": "0.18.79",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"